GitHub-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
4117 Commits
61 Branches
369 Tags
120 MiB
Branch: 3.0.x
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '3.0.x'
${ noResults }
Commit Graph

236 Commits (3.0.x)

Author SHA1 Message Date
Rob Winch fb227b5433 SEC-2025: SecurityContextLogoutHandler removes Authentication from SecurityContext
13 years ago
Rob Winch 4f993d95b5 Updates for 3.0.x autorepo support
13 years ago
Rob Winch 4c832fc946 SEC-2038: AbstractPreAuthenticationFilter afterPropertiesSet invokes super
13 years ago
Rob Winch 5945abb10a Revert "SEC-2045: AbstractPreAuthenticationFilter afterPropertiesSet invokes super"
13 years ago
Rob Winch 8c224f39dc SEC-2045: AbstractPreAuthenticationFilter afterPropertiesSet invokes super
13 years ago
Rob Winch f0a6b7ca27 SEC-2041: SaveContextServletOutputStream/SaveContextPrintWriter delegate all methods
13 years ago
Rob Winch 0350c2833e SEC-2055: SaveContextServletOutputStream flush/close delegates to original ServletOutputStream instead of using super
13 years ago
Rob Winch ca3c1979b8 SEC-2005: Ensure SecurityContext saved prior to the response being committed
14 years ago
Rob Winch c9facdd993 SEC-2013: Add space to log of AbstractAuthenticationProcessingFilter
14 years ago
Rob Winch d2e6343295 SEC-1968: AbstractPreAuthenticatedProcessingFilter clears SecurityContext on null principal change with invalidateSessionOnPrincipalChange = true
14 years ago
Rob Winch 31338a7bdb SEC-1875: ConcurrentSessionControlStrategy no longer adds/removes the session to the SessionRegistry twice
14 years ago
Rob Winch 5dd6b4a77a SEC-1865: Remove invalid OWASP link in TextEscapeUtils
14 years ago
Rob Winch 21f2991ab4 Call SecurityContextHolder.clearContext() in tear down of HttpSessionSecurityContextRepositoryTests
14 years ago
Rob Winch 3679227b11 SEC-1735: Do not remove SecurityContext from HttpSession when anonymous Authentication is saved if original SecurityContext was anonymous
14 years ago
Rob Winch 9847366d5e SEC-1881: Renamed **/*Test.java to **/*Tests.java since **/*Test.java are not included in surefire configuration
14 years ago
Luke Taylor 2d27b28199 Set version to 3.0.8.CI-SNAPSHOT.
14 years ago
Luke Taylor 714ee3e960 Set version to 3.0.7.RELEASE.
14 years ago
Luke Taylor ee74c4ced2 SEC-1803: Add check in AbstractAuthenticationTargetUrlRequestHandler for null targetUrlParameter before attempting to read it from the request. Prevents NPE when targetUrlParameter is not set.
15 years ago
Luke Taylor 3dc4158f7d Set version to 3.0.7.CI-SNAPSHOT
15 years ago
Luke Taylor 62f70f17ff Set project release version to 3.0.6.RELEASE
15 years ago
Luke Taylor a087e828a6 SEC-1790: Disable use of spring-security-redirect by default for SimpleUrlLogoutSuccesshandler.
15 years ago
Luke Taylor 5238ba0e26 SEC-1790: Reject redirect locations containing CR or LF.
15 years ago
Luke Taylor ca2af8bc59 SEC-1770: Call refreshLastRequest on the session registry rather than the SessionInformation object to make sure it works with alternative SessionRegistry implementations.
15 years ago
Rob Winch f359bed596 SEC-1777: Corrected log in HttpSessionSecurityContextRepository to reference itself instead of HttpSessionContextIntegrationFilter
15 years ago
Luke Taylor 73b67da3a8 SEC-1762: Fix input value assertion check for targetUrlParameter.
15 years ago
Luke Taylor 977da0da1f SEC-1733: Support explicit zero netmask correctly.
15 years ago
Luke Taylor 1833b234a5 SEC-1722: Correct javadoc
15 years ago
Luke Taylor b87dabe1ac SEC-1683: Corrected typo
15 years ago
Rob Winch 1b6587a5d4 SEC-1666: Use constant time comparison for sensitive data.
15 years ago
Rob Winch b3943ac268 SEC-1545: Removed unused i18n keys, changed keys to follow naming conventions, found missing keys based upon old keys, sorted keys, any unknown keys are entered as a comment with the English value.
15 years ago
Luke Taylor 537d8f108a SEC-1654: Correct debug output in DigestAuthenticationFilter.
15 years ago
Rob Winch 4dea140331 SEC-1639: FirewalledRequest is now called on the specific FirewalledRequest instance rather that looping through ServletRequestWrappers.
15 years ago
Luke Taylor bb3a973fcb SEC-1636: Add optimizations for universal match cases in AntUrlPathMatcher (using "/**" and "**" equality checks on the path).
15 years ago
Luke Taylor d53db3ba13 Update version to 3.0.6.CI-SNAPSHOT.
15 years ago
Luke Taylor 90304f64c6 Update version for 3.0.5 release
15 years ago
Luke Taylor e80853b698 SEC-1412: DefaultSavedRequest should ignore "If-Modified-Since" headers to prevent re-displaying the login form (the cached result of the original request).
15 years ago
Luke Taylor 82d105cbc3 SEC-1587: Add explicit call to removeAttribute() to remove the context from the session if the current context is empty or anonymous.
15 years ago
Luke Taylor e88f47a96a SEC-1561: Add check on whether the security context attribute is set in the current session to make sure it is stored when a new session has been created during the request.
15 years ago
Rob Winch 0bdc9c176b SEC-1606: Added a FirewalledRequestAwareRequestDispatcher that will call FirewalledRequest.reset() before a forward
15 years ago
Luke Taylor 71b2af31ee SEC-1608: Make sure FirewalledRequest.reset() is called when filter="none"
15 years ago
Luke Taylor 3cfe23f60d Update versions to 3.0.5.CI-SNAPSHOT
15 years ago
Luke Taylor 82d140ffb1 Version 3.0.4.RELEASE
15 years ago
Luke Taylor 1563491322 SEC-1600: Added Implementation-Version and Implementation-Title to manifest templates and checking of version numbers in namespace config module and core. Config checks the version of core it is running against and core checks the Spring version, reporting any mismatches or situations where the app is running with less than the recommended Spring version.
15 years ago
Luke Taylor b688bb69ee SEC-1543: Change IpAddressMatcher to return false when comparing an Inet6Address with an Inet4Address rather than raising an exception.
15 years ago
Luke Taylor 8e68fa1334 SEC-1584: Added namespace support for injecting custom HttpFirewall instance into FilterChainProxy.
15 years ago
Luke Taylor ed9411c660 SEC-1584: Addition of HttpFirewall strategy to FilterChainProxy to reject un-normalized requests and wrap the incoming request object before processing by the security filter chain to provide a more consistent representation of paths than is guaranteed by the servlet spec. The wrapper strips path parameters from pathInfo and servletPath to provide consistency of URL matching across servlet containers and protect against bypassing security constraints by the malicious addition of such parameters to the URL. The paths are canonicalized further by replacing of multiple sequences of "/" characters with a single "/".
15 years ago
Luke Taylor 25d222208d Switch version to 3.0.4-CI-SNAPSHOT.
16 years ago
Luke Taylor 9b0c21dfef 3.0.3 release. Update version in build files.
16 years ago
Luke Taylor 1872d94aa1 Porting gradle changes from master
16 years ago
Luke Taylor 80ccd2b285 SEC-1501: Fix bean classname in Javadoc for SwitchUserFilter.
16 years ago